My take on the issues
Why was the ruling deemed unlawful?
The European Commission had identified the Data Protection Directive as
providing a legal basis for the transfer of passenger details to the
USA's Bureau of Customs and Border Protection. However, the Court's
judgement states that the Passenger personal data are collected by
Airlines for use in passenger and flight administration, but the PNR
transfer is for a purpose related to national security, public safety
and criminal matters.
As the Directive does not apply to personal data processed for these
national security related purposes, the Court concluded that there was
therefore no legal basis for the transfer. This means that European
Commission could not claim that the Directive gave authority for the
transfer of PNR to the USA
The Court has set a deadline of 30th September before its order comes
into effect. This gives time for the authorities to arrive at a new
basis for the transfer.
Who took the action and why?
The first point is to say that this action was not taken because the
Parliament wanted to hinder the authorities in their anti-terrorist
activities. What it is saying is that there needs to be a correct
balance between security and privacy.
In 2003, the Parliament and all of Europe's Data Protection
Commissioners raised concerns about the excessive amount of data being
transferred, the retention of data in the USA for long periods, the fact
that USA authorities had on-line access to airline reservation systems
and could copy data into their own databases, the fact there was no
effective enforcement of the rights of data subjects (e.g. to access
their own personal data), or independent supervision of the data sharing
arrangement.
Perhaps if the Commission/USA authorities had taken more notice of
these views, then the Parliament's legal action might not have been
necessary.
In Australia, for example, there is an approved agreement to transfer
PNR. The Australians only use half the number of data items, and data on
travellers are not retained for years on end - and there is a system of
independent supervision.
Will this hinder the fight against terror?
NO. The Court's judgment does not come into effect until September 30th
and I suspect that the European Commission and the USA administration
will agree another route for the transfer of personal data. If the
European Commission cannot form a new legal basis for the transfer, I
expect that such transfers to be agreed on a bi-lateral basis.
I see the judgment as a shot across the bows: security and privacy has
to be in balanced in a way which most reasonable people will accept, and
that there must be independent supervision of the whole process so that
those who use powers to obtain personal data do not exceed those powers.
Dr. C.N.M. Pounder
Consultant & Editor of Data Protection & Privacy Practice
Pinsent Masons
International Law Firm
Outsourcing & Technology Group
Post-mail: 30 Aylesbury Street, London EC1R 0ER, UK
DDI: +44(0)20 7490 6605 Mob: 077990 35058
Fax: +44(0)20 7490 2545
E-mail: [log in to unmask]
www.pinsentmasons.com
www.out-law.com
The contents of this e-mail and any attachments are confidential to the intended recipient. If you are not the intended recipient please do not use or publish its contents, contact Pinsent Masons immediately on +44 (0)20 7418 7000 then delete it. Contracts cannot be concluded with us nor service effected by email. Pinsent Masons may monitor traffic data. Further information about us is available at www.pinsentmasons.com.
This message has been scanned for viruses by MailControl, a service from BlackSpider Technologies.
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
All archives of messages are stored permanently and are
available to the world wide web community at large at
http://www.jiscmail.ac.uk/lists/data-protection.html
If you wish to leave this list please send the command
leave data-protection to [log in to unmask]
All user commands can be found at : -
http://www.jiscmail.ac.uk/help/commandref.htm
Any queries about sending or receiving message please send to the list owner
[log in to unmask]
(all commands go to [log in to unmask] not the list please)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
|